ATTENTION: Message Board Security Issues About This Page:

[Sandra Bostwick]

Still getting the error messages, but I sure am appreciative of all the work being put into solving the problem. Count me as hanging in there!

[Sue M.]

Aw, my photos are gone too! I'm on a Mac. Still getting the security message using Safari, but no message using Firefox.
What a mess for you both having to deal with all this.

I am on Mac and don't run windows Dave, thanks for answering my question. So I guess my computer is not vulnarable to this?

[Dave Marx]

Sue, if you're running Safari 4.0.2 or older, do an update on Safari.

[Sue M.]

I'm running 4.0.4 Safari. Is this the latest?

[Sandra Bostwick]

I am still getting error messages. My Malware Scan log looks like this if it helps. The scans were clean before 12/11.


Registry Keys Infected: 12/11
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explo rer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explo rer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\seekdns (Adware.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\nethelp (Trojan.FakeAlert) -> Delete on reboot.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\syste m32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.
Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.
Files Infected:
C:\Program Files\Seekdns\uninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\sdra64.exe (Spyware.Zbot) -> Delete on reboot.

12/12

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\nethelp (Trojan.FakeAlert) -> Delete on reboot.
Registry Data Items Infected:
(No malicious items detected)

12/14

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\nethelp (Trojan.FakeAlert)

Looks to me like Dave killed the worst bugs, but I have no idea what I'm talking about.

[shadowryter]

No longer getting warning signs. AVG free version scans and updates every morninng, but my photo albums are gone.I run Vista with IE8 and my virus vault has a lot quarantined like Sandy's. I thought it was just me.

[mommadjones]

I think I was luck enough my computer wasn't affected(knocks on wood). I run AVG free, Spyware Doctor and the Anti-Spyware that comes with our internet provider comcast EVERY day and some times multiple times a day. Good Luck everyone I hope all your computers are ok and bug free!!!!

[Sandra Bostwick]

Originally Posted by shadowryter

No longer getting warning signs. AVG free version scans and updates every morninng, but my photo albums are gone.I run Vista with IE8 and my virus vault has a lot quarantined like Sandy's. I thought it was just me.

Grrrrrrrrrr. I still get the warnings every time I change screens, but it looks like the worst hit came on the 11th, based on the reports.

[taylan1]

I am finally no longer getting the warnings, looks like Google Chrome caught up. I never got any of the trojans, fortunately. I use Vipre Antivirus and AntiSpyware and have had absolutely no issues.


My photo album is still not showing any pictures though. I hope that gets worked out soon.

[Sue M.]

Still getting warnings using Safari, why is this?

[Dave Marx]

Yes, 4.04 is the latest Safari. What warnings are you getting?

[Sandra Bostwick]

Dave, I'm getting this:

Errors on this webpage might cause it to work incorrectly. 'vB_QuickEditor_Watcher' is undefined
cbulletin_quick_comments.js
Code: 0 Line:11 CHar:3784
URI: http://www.passporterboards.com/foru...mment.js?v=384

[Sue M.]

Dave, it says:
Warning Visiting this site may harm your computer.
The website you are visiting appears to contain Malware..........explains what malware is......
For detailed information about problems found on this site visit Google Safe Browsing diagnostic page on centiyo.com

Thanks for your help Dave and Jennifer!

[disneydreamer33]

I am on every day and I have not received any warnings, my only issue is my pictures not showing up in my photo albums.
thanks Dave for letting us know what was going on.

[qesue]

I am not able to access the boards from my personal computer. Every time I try, I get a message warning about Malware which says "........contains elements from the site centiyo.com which appears to be malware...." . This is the only computer in the house that has Windows 7 as an operating system. All others use XP. Not sure if it makes a difference. Also not sure if the browser makes a difference. I haven't been able to access the boards using Google Chrome, but Firefox allowed it on this machine. I think I'm dealing with too many variables at the moment. Am running a scan on my computer now, hoping to rectify the problem.